{"id":"CVE-2026-68117","summary":"tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create()\n\nWhen tipc_sk_create() fails to insert the new socket (tipc_sk_insert()\nreturns non-zero), its error path frees the sk with sk_free() but leaves\nsock-\u003esk pointing at the freed object:\n\n\tif (tipc_sk_insert(tsk)) {\n\t\tsk_free(sk);\n\t\tpr_warn(\"Socket create failed; port number exhausted\\n\");\n\t\treturn -EINVAL;\n\t}\n\nThis is harmless for plain socket(): the syscall layer clears sock-\u003eops\nbefore releasing, so tipc_release() is never called. It is not harmless\non the accept() path. tipc_accept() creates the pre-allocated child\nsocket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves\nnew_sock-\u003esk dangling and new_sock-\u003eops non-NULL, and do_accept() then\nfput()s the new file, so __sock_release() -\u003e tipc_release() runs\nlock_sock(new_sock-\u003esk) on the freed sk -- a use-after-free write of the\nsk_lock spinlock.\n\ntipc_release() already guards this exact \"failed accept() releases a\npre-allocated child\" case with \"if (sk == NULL) return 0;\", but the\nguard is bypassed because tipc_sk_create() left sock-\u003esk non-NULL\n(dangling) rather than NULL.\n\nClear sock-\u003esk on the failed-insert path so the existing tipc_release()\nNULL check fires and the use-after-free is avoided.\n\nThe tipc_sk_insert() failure is reached when the per-netns socket\nrhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M\nelements) -- i.e. once a netns holds ~2M TIPC sockets every insert\nreturns -E2BIG.\n\n  BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)\n  Write of size 8 at addr ffff8880047cdc38 by task init/1\n   lock_sock_nested (net/core/sock.c:3839)\n   tipc_release (net/tipc/socket.c:638)\n   __sock_release (net/socket.c:710)\n   sock_close (net/socket.c:1501)\n   __fput (fs/file_table.c:512)\n  Allocated by task 1:\n   sk_alloc (net/core/sock.c:2308)\n   tipc_sk_create (net/tipc/socket.c:487)\n   tipc_accept (net/tipc/socket.c:2744)\n   do_accept (net/socket.c:2034)\n  Freed by task 1:\n   __sk_destruct (net/core/sock.c:2391)\n   tipc_sk_create (net/tipc/socket.c:504)\n   tipc_accept (net/tipc/socket.c:2744)\n   do_accept (net/socket.c:2034)","modified":"2026-10-28T02:30:44.166844901Z","published":"2026-08-10T11:58:36.675Z","related":["ALSA-2026:66324","ALSA-2026:66325","ALSA-2026:67150","ALSA-2026:85321","SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:23881-1","SUSE-SU-2026:23887-1","SUSE-SU-2026:23897-1","SUSE-SU-2026:23902-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","SUSE-SU-2026:4282-1","openSUSE-SU-2026:21910-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68117.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5f5a41a48dbf9eda57b67ce23e548602cf7195a6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/82f59aa27f33bd014a7d8739371ab5712d15e33b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8d6f26d48e61ef34f1921289401dbf36b10816af"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b07d87b31631edb6529e6cdcca790a7489d1250d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ba0533fc163f905fe817cfabdf8ed4058da44800"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea"},{"type":"WEB","url":"https://git.kernel.org/stable/c/efebc23e9b29e3e5a9e2127dd066929f7f0d315e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f9596b1566616a8be0592dbceccb6344a7c6f6bb"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68117.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68117"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"efa78f2ae363428525fb4981bb63c555ee79f3c7"},{"fixed":"efebc23e9b29e3e5a9e2127dd066929f7f0d315e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"833ecd0eae76eadf81d6d747bb5bc992d1151867"},{"fixed":"8d6f26d48e61ef34f1921289401dbf36b10816af"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"00aff3590fc0a73bddd3b743863c14e76fd35c0c"},{"fixed":"82f59aa27f33bd014a7d8739371ab5712d15e33b"},{"fixed":"b07d87b31631edb6529e6cdcca790a7489d1250d"},{"fixed":"dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea"},{"fixed":"5f5a41a48dbf9eda57b67ce23e548602cf7195a6"},{"fixed":"f9596b1566616a8be0592dbceccb6344a7c6f6bb"},{"fixed":"ba0533fc163f905fe817cfabdf8ed4058da44800"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.132"},{"fixed":"5.10.265"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.15.56"},{"fixed":"5.15.216"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.9.324"},{"fixed":"4.10"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.14.289"},{"fixed":"4.15"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.19.253"},{"fixed":"4.20"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.4.207"},{"fixed":"5.5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.18.13"},{"fixed":"5.19"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"638fa20b618b2bbcf86da71231624cc82121a036"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7bc9e7f70bc57d8f02ffea2a42094281effb15ef"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ef488669b2652bde5b6ee5a409a5b048a2a50db4"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4919d82f7041157a421ca9bf39a78551d5ad8a1b"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2"}]}],"versions":["v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.10.248","v5.10.247","v5.10.246","v5.10.245","v5.10.244","v5.10.243","v5.10.242","v5.10.241","v5.10.240","v5.10.239","v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.10.232","v5.10.231","v5.10.230","v5.10.229","v5.10.228","v5.10.227","v5.10.226","v5.10.225","v5.10.224","v5.10.223","v5.10.222","v5.10.221","v5.10.220","v5.10.219","v5.10.218","v5.10.217","v5.10.216","v5.10.215","v5.10.214","v5.10.213","v5.10.212","v5.10.211","v5.10.210","v5.10.209","v5.10.208","v5.10.207","v5.10.206","v5.10.205","v5.10.204","v5.10.203","v5.10.202","v5.10.201","v5.10.200","v5.10.199","v5.10.198","v5.10.197","v5.10.196","v5.10.195","v5.10.194","v5.10.193","v5.10.192","v5.10.191","v5.10.190","v5.10.189","v5.10.188","v5.10.187","v5.10.186","v5.10.185","v5.10.184","v5.10.183","v5.10.182","v5.10.181","v5.10.180","v5.10.179","v5.10.178","v5.10.177","v5.10.176","v5.10.175","v5.10.174","v5.10.173","v5.10.172","v5.10.171","v5.10.170","v5.10.169","v5.10.168","v5.10.167","v5.10.166","v5.10.165","v5.10.164","v5.10.163","v5.10.162","v5.10.161","v5.10.160","v5.10.159","v5.10.158","v5.10.157","v5.10.156","v5.10.155","v5.10.154","v5.10.153","v5.10.152","v5.10.151","v5.10.150","v5.10.149","v5.10.148","v5.10.147","v5.10.146","v5.10.145","v5.10.144","v5.10.143","v5.10.142","v5.10.141","v5.10.140","v5.10.139","v5.10.138","v5.10.137","v5.10.136","v5.10.135","v5.10.134","v5.10.133","v5.10.132","v5.15.215","v5.15.214","v5.15.213","v5.15.212","v5.15.211","v5.15.210","v5.15.209","v5.15.208","v5.15.207","v5.15.206","v5.15.205","v5.15.204","v5.15.203","v5.15.202","v5.15.201","v5.15.200","v5.15.199","v5.15.198","v5.15.197","v5.15.196","v5.15.195","v5.15.194","v5.15.193","v5.15.192","v5.15.191","v5.15.190","v5.15.189","v5.15.188","v5.15.187","v5.15.186","v5.15.185","v5.15.184","v5.15.183","v5.15.182","v5.15.181","v5.15.180","v5.15.179","v5.15.178","v5.15.177","v5.15.176","v5.15.175","v5.15.174","v5.15.173","v5.15.172","v5.15.171","v5.15.170","v5.15.169","v5.15.168","v5.15.167","v5.15.166","v5.15.165","v5.15.164","v5.15.163","v5.15.162","v5.15.161","v5.15.160","v5.15.159","v5.15.158","v5.15.157","v5.15.156","v5.15.155","v5.15.154","v5.15.153","v5.15.152","v5.15.151","v5.15.150","v5.15.149","v5.15.148","v5.15.147","v5.15.146","v5.15.145","v5.15.144","v5.15.143","v5.15.142","v5.15.141","v5.15.140","v5.15.139","v5.15.138","v5.15.137","v5.15.136","v5.15.135","v5.15.134","v5.15.133","v5.15.132","v5.15.131","v5.15.130","v5.15.129","v5.15.128","v5.15.127","v5.15.126","v5.15.125","v5.15.124","v5.15.123","v5.15.122","v5.15.121","v5.15.120","v5.15.119","v5.15.118","v5.15.117","v5.15.116","v5.15.115","v5.15.114","v5.15.113","v5.15.112","v5.15.111","v5.15.110","v5.15.109","v5.15.108","v5.15.107","v5.15.106","v5.15.105","v5.15.104","v5.15.103","v5.15.102","v5.15.101","v5.15.100","v5.15.99","v5.15.98","v5.15.97","v5.15.96","v5.15.95","v5.15.94","v5.15.93","v5.15.92","v5.15.91","v5.15.90","v5.15.89","v5.15.88","v5.15.87","v5.15.86","v5.15.85","v5.15.84","v5.15.83","v5.15.82","v5.15.81","v5.15.80","v5.15.79","v5.15.78","v5.15.77","v5.15.76","v5.15.75","v5.15.74","v5.15.73","v5.15.72","v5.15.71","v5.15.70","v5.15.69","v5.15.68","v5.15.67","v5.15.66","v5.15.65","v5.15.64","v5.15.63","v5.15.62","v5.15.61","v5.15.60","v5.15.59","v5.15.58","v5.15.57","v5.15.56","v4.9.337","v4.9.336","v4.9.335","v4.9.334","v4.9.333","v4.9.332","v4.9.331","v4.9.330","v4.9.329","v4.9.328","v4.9.327","v4.9.326","v4.9.325","v4.9.324","v4.14.336","v4.14.335","v4.14.334","v4.14.333","v4.14.332","v4.14.331","v4.14.330","v4.14.329","v4.14.328","v4.14.327","v4.14.326","v4.14.325","v4.14.324","v4.14.323","v4.14.322","v4.14.321","v4.14.320","v4.14.319","v4.14.318","v4.14.317","v4.14.316","v4.14.315","v4.14.314","v4.14.313","v4.14.312","v4.14.311","v4.14.310","v4.14.309","v4.14.308","v4.14.307","v4.14.306","v4.14.305","v4.14.304","v4.14.303","v4.14.302","v4.14.301","v4.14.300","v4.14.299","v4.14.298","v4.14.297","v4.14.296","v4.14.295","v4.14.294","v4.14.293","v4.14.292","v4.14.291","v4.14.290","v4.14.289","v4.19.325","v4.19.324","v4.19.323","v4.19.322","v4.19.321","v4.19.320","v4.19.319","v4.19.318","v4.19.317","v4.19.316","v4.19.315","v4.19.314","v4.19.313","v4.19.312","v4.19.311","v4.19.310","v4.19.309","v4.19.308","v4.19.307","v4.19.306","v4.19.305","v4.19.304","v4.19.303","v4.19.302","v4.19.301","v4.19.300","v4.19.299","v4.19.298","v4.19.297","v4.19.296","v4.19.295","v4.19.294","v4.19.293","v4.19.292","v4.19.291","v4.19.290","v4.19.289","v4.19.288","v4.19.287","v4.19.286","v4.19.285","v4.19.284","v4.19.283","v4.19.282","v4.19.281","v4.19.280","v4.19.279","v4.19.278","v4.19.277","v4.19.276","v4.19.275","v4.19.274","v4.19.273","v4.19.272","v4.19.271","v4.19.270","v4.19.269","v4.19.268","v4.19.267","v4.19.266","v4.19.265","v4.19.264","v4.19.263","v4.19.262","v4.19.261","v4.19.260","v4.19.259","v4.19.258","v4.19.257","v4.19.256","v4.19.255","v4.19.254","v4.19.253","v5.4.302","v5.4.301","v5.4.300","v5.4.299","v5.4.298","v5.4.297","v5.4.296","v5.4.295","v5.4.294","v5.4.293","v5.4.292","v5.4.291","v5.4.290","v5.4.289","v5.4.288","v5.4.287","v5.4.286","v5.4.285","v5.4.284","v5.4.283","v5.4.282","v5.4.281","v5.4.280","v5.4.279","v5.4.278","v5.4.277","v5.4.276","v5.4.275","v5.4.274","v5.4.273","v5.4.272","v5.4.271","v5.4.270","v5.4.269","v5.4.268","v5.4.267","v5.4.266","v5.4.265","v5.4.264","v5.4.263","v5.4.262","v5.4.261","v5.4.260","v5.4.259","v5.4.258","v5.4.257","v5.4.256","v5.4.255","v5.4.254","v5.4.253","v5.4.252","v5.4.251","v5.4.250","v5.4.249","v5.4.248","v5.4.247","v5.4.246","v5.4.245","v5.4.244","v5.4.243","v5.4.242","v5.4.241","v5.4.240","v5.4.239","v5.4.238","v5.4.237","v5.4.236","v5.4.235","v5.4.234","v5.4.233","v5.4.232","v5.4.231","v5.4.230","v5.4.229","v5.4.228","v5.4.227","v5.4.226","v5.4.225","v5.4.224","v5.4.223","v5.4.222","v5.4.221","v5.4.220","v5.4.219","v5.4.218","v5.4.217","v5.4.216","v5.4.215","v5.4.214","v5.4.213","v5.4.212","v5.4.211","v5.4.210","v5.4.209","v5.4.208","v5.4.207","v5.18.19","v5.18.18","v5.18.17","v5.18.16","v5.18.15","v5.18.14","v5.18.13"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68117.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.265"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.216"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.19.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68117.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}